CVE-2022-46293

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Babel 3.1.1 and master commit 530dbfa3. A specially-crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability affects the MOPAC file format, inside the Final Point and Derivatives section

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-787

Affected software

Vendor	Product	Versions
Open Babel	Open Babel	3.1.1; master commit 530dbfa3
open_babbel	open_babbel	3.1.1; master_commit_530dbfa3

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666Exploit, Technical Description, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666Exploit, Technical Description, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1666

Timeline

Published: Jul 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-462947.8Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab CVE-2022-462957.8Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab CVE-2022-462984.4Incomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.CVE-2022-462995.5Insufficient control flow management for some Intel Unison software may allow an authenticated user to potentially enable information disclo CVE-2022-46305.3Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.CVE-2022-463005.5Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.CVE-2022-463014.4Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.CVE-2022-463028.8Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy confi CVE-2022-463037.5Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with CVE-2022-463048.8ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated r CVE-2022-463056.5ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass CVE-2022-463067.8ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path